Hacking Official [Release] CakesFW

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,979
Trophies
4
Location
Making a non-binary fuss
XP
39,456
Country
Antarctica
It's ok, it's kinda hidden cause it probably will the 138 users keep asking how to do it in the stable version. And I don't care to answer since it is not a normal question xD
Yeah, I had to really study it to understand the post. Because at first I thought it required me to boot into system settings first. Not sysnand, remove the SD, then boot into system settings.
Either way, it's working now and I am a happy girl.
 
  • Like
Reactions: Gray_Jack

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,979
Trophies
4
Location
Making a non-binary fuss
XP
39,456
Country
Antarctica
I believe mid-kid doesn't want to make it such a big deal because he intends to fix the decryption bug before the new release.
As such, if he starts telling everyone to do these workarounds, most people are likely to do them after future releases come along.
Fair enough, but since I removed all the patches, I couldn't play GBA/DS(i) games on CakeFW, so it became grossly under used in my CFW's. So getting them to work became priority number one to me.
 

Wolfvak

nyaa~
Member
Joined
Oct 25, 2015
Messages
918
Trophies
1
XP
3,486
Country
Uruguay
Fair enough, but since I removed all the patches, I couldn't play GBA/DS(i) games on CakeFW, so it became grossly under used in my CFW's. So getting them to work became priority number one to me.
Well, they do now. Cakes has supported AGB_FIRM patching for a long time now, it's just that no one made patches for it. mid-kid made them himself, and me, being the glorious idiot I am, decided to make my own as well (didn't know he made them before I did).

TWL_FIRM patching is also supported, just a bit more recently.
 

The Catboy

GBAtemp Official Catboy™: Boywife
Member
Joined
Sep 13, 2009
Messages
27,979
Trophies
4
Location
Making a non-binary fuss
XP
39,456
Country
Antarctica
Well, they do now. Cakes has supported AGB_FIRM patching for a long time now, it's just that no one made patches for it. mid-kid made them himself, and me, being the glorious idiot I am, decided to make my own as well (didn't know he made them before I did).

TWL_FIRM patching is also supported, just a bit more recently.
That I knew, I just couldn't get them to work for me, until 30 minutes. Still, I am glad everyone helped me figure this out ^_^
 

Kazuma77

Well-Known Member
Member
Joined
May 11, 2008
Messages
1,035
Trophies
1
XP
919
Country
United States
The OP mentions it in the 'Current nightly additional information:'

Ah, so that's where I saw it before. I forgot the original suggested removing the memory card. Just didn't sound like a good thing to do to a perfectly healthy SD card. So I changed my version of it to use CTRXplorer. Oddly enough, even rebooting into Godmode9 to move the files, then rebooting into Cakes, doesn't seem to wipe the needed info from RAM (found that out with a system I forgot to install CTRXplorer on).

EDIT: That's odd, the latest nightly just went from 173 to 170. We're moving back instead of forwards.
 
Last edited by Kazuma77,

Krude

Well-Known Member
Member
Joined
May 18, 2013
Messages
344
Trophies
0
XP
1,208
Country
Gambia, The
If you've got an A9LH system, what you could do is backup your NATIVE_FIRM folder to SD using Godmode9, rename it (put an A at the end or something), install the CIA, go back into Godmode9 and copy NATIVE_FIRM folder to SD again, rename it as well (put a B at the end for example), then rename the the original folder back, and copy it back over to restore the correct NATIVE_FIRM. Technically, the system should be unaffected by you replacing NATIVE_FIRM as long as you're not actually using CTRNAND NATIVE_FIRM, i.e. booting Luma without firmware.bin in place. I just suggested backing the folder up as a precaution. You should be able to restore the current NATIVE_FIRM via CIA. Anyway, once you're done, you should have a decrypted copy of the 9.0 NATIVE_FIRM in your SD card's 00000002B folder (or 20000002B folder if it's an N3DS). As usual, you should make a SysNAND backup first just in case anything goes wrong.

I'm p. sure this would irreversibly brick my console, since on A9LH the secret sector is garbled and if i install a FIRM to NAND, the bootloader can't decrypt that firm anymore and i can look at that nice blue error screen.

And i'm not trying to get a decrypted 9.0 FIRM here (these are easy to find on the internet), i wanto boot Cakes with an encrypted 9.0 FIRM.
 

Kazuma77

Well-Known Member
Member
Joined
May 11, 2008
Messages
1,035
Trophies
1
XP
919
Country
United States
I'm p. sure this would irreversibly brick my console, since on A9LH the secret sector is garbled and if i install a FIRM to NAND, the bootloader can't decrypt that firm anymore and i can look at that nice blue error screen.

And i'm not trying to get a decrypted 9.0 FIRM here (these are easy to find on the internet), i wanto boot Cakes with an encrypted 9.0 FIRM.

If that was how it worked, that 11.0 update would have bricked us all -- it installs a NATIVE_FIRM after all.

NATIVE_FIRM installs to CTRNAND, not the firm0 and firm1 partitions (or at least, if it does try to install anything to firm0 and firm1, the "block FIRM partition updates" patch will prevent it, I don't claim to be an expert on how 3DS firmware works, but I am sure of that). If we couldn't update NATIVE_FIRM, how is Luma running the 11.0 NATIVE_FIRM without a firmware.bin then? Shouldn't it still be on 10.4? Though I guess it wouldn't get you what you want then. Unless d0k3 were to add an "encrypted" option to Godmode9. You know, that's not a bad idea.

Cakes supports decrypted files now, as of 169 I think. Check your firmware files. Do they have a different date than the ones you copied over? If so, they're probably decrypted.

Oh and, N3DS or O3DS? I actually have both. I'm not sure what would be a good way to get them to you though. It's not like I can upload them as an attachment.
 
Last edited by Kazuma77,

Krude

Well-Known Member
Member
Joined
May 18, 2013
Messages
344
Trophies
0
XP
1,208
Country
Gambia, The
Since only N3DSes have secret sectors, it should be obvious from my post which one i have.

I have a 9.2 sysNAND, and titles on NAND are already unencrypted so yeah, i can just pull a decrypted 9.0 FIRM from my CTRNAND but again, not what i'm looking for. I'm looking for a way to boot a properly encrypted, exploitable firmware on a stable release of CakesFW.
 

Wolfvak

nyaa~
Member
Joined
Oct 25, 2015
Messages
918
Trophies
1
XP
3,486
Country
Uruguay
... how is Luma running the 11.0 NATIVE_FIRM without a firmware.bin then? Shouldn't it still be on 10.4? Though I guess it wouldn't get you what you want then. Unless d0k3 were to add an "encrypted" option to Godmode9. You know, that's not a bad idea.

Cakes supports decrypted files now, as of 169 I think. Check your firmware files. Do they have a different date than the ones you copied over? If so, they're probably decrypted.

Oh and, N3DS or O3DS? I actually have both. I'm not sure what would be a good way to get them to you though. It's not like I can upload them as an attachment.
The firmware found in CTRNAND is still encrypted actually. Like, completely encrypted, is doesn't even show the FIRM magic, so I assume its ExeFS is still encrypted (+arm9bin in N3DS)
 

Kazuma77

Well-Known Member
Member
Joined
May 11, 2008
Messages
1,035
Trophies
1
XP
919
Country
United States
The firmware found in CTRNAND is still encrypted actually. Like, completely encrypted, is doesn't even show the FIRM magic, so I assume its ExeFS is still encrypted (+arm9bin in N3DS)

Actually, that makes sense now that I think about it. It only decrypts the partitions themselves. Not the files within. Like the first pass when you're having D9 cryptofix an encrypted .cia file. Actually, that's another thought.

OK @Krude, guess that means you can just rip it from your own SysNAND. Failing that, try running D9's "CIA Decryptor (shallow)" option on the CIA, then try to extract it again with ctrtool (that should solve any problems it's having opening it, while leaving the files inside encrypted). If that doesn't work, well, ask ApacheThunder. There's no way he repacked all those system apps without knowing how to extract the CIAs.
 
Last edited by Kazuma77,

MiePx3

Well-Known Member
Member
Joined
Jan 4, 2016
Messages
130
Trophies
0
XP
352
Country
Gambia, The
Hey @mid-kid,

I just got my new 3DS, so I started a new A9LH setup from scratch.
And for some strange reason does autobooting with the lastest nightly (174) not work.
Pressing L and boot into CFW with the first boot option does work fine.

171 autoboots without a problem!
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
Hey @mid-kid,

I just got my new 3DS, so I started a new A9LH setup from scratch.
And for some strange reason does autobooting with the lastest nightly (174) not work.
Pressing L and boot into CFW with the first boot option does work fine.

171 autoboots without a problem!

Fixed it (untested, but it should work), will pop up in 175 in less than an hour.
 
  • Like
Reactions: klear and hausa51

MiePx3

Well-Known Member
Member
Joined
Jan 4, 2016
Messages
130
Trophies
0
XP
352
Country
Gambia, The
Fixed it (untested, but it should work), will pop up in 175 in less than an hour.
Awesome. Will try it out immediately.

Question,
I tried the latest stable, v163 (didnt have the problem on it, O3DS) and v171. On all of them, in "More options" "Select emuNAND" Cakes showes me "emuNAND #1".
Why is that? I formatted my SD twice with emuNAND9 using the no emuNAND option. My Computer shoes that the SD card only has one partion.
Is that a new3DS thing? Or why does it show me one emuNAND? Can I delete it? Where? "Enable emuNAND" is not enabled.
 

mid-kid

GBAtemp spamBOT
OP
Member
Joined
Aug 2, 2012
Messages
879
Trophies
0
Age
25
XP
1,163
Country
Awesome. Will try it out immediately.

Question,
I tried the latest stable, v163 (didnt have the problem on it, O3DS) and v171. On all of them, in "More options" "Select emuNAND" Cakes showes me "emuNAND #1".
Why is that? I formatted my SD twice with emuNAND9 using the no emuNAND option. My Computer shoes that the SD card only has one partion.
Is that a new3DS thing? Or why does it show me one emuNAND? Can I delete it? Where? "Enable emuNAND" is not enabled.

Formatting an sd card does not remove all the data on it. The NCSD header from an old rednand seems to still be present in the second sector. To clear it, you could try either removing the "NCSD" at 0x300 from the start of your SD with a hex editor, or clear the whole second sector using for example dd: "dd if=/dev/zero of=/dev/<sd card> bs=512 seek=1 count=1"
 
  • Like
Reactions: astronautlevel

MiePx3

Well-Known Member
Member
Joined
Jan 4, 2016
Messages
130
Trophies
0
XP
352
Country
Gambia, The
Didnt work sadly.
I tried this command on windows: dd if=/dev/zero of=\\.\f: bs=512 seek=1 count=1
Output was:
1+0 records in
1+0 records out
 

Wolfvak

nyaa~
Member
Joined
Oct 25, 2015
Messages
918
Trophies
1
XP
3,486
Country
Uruguay
Didnt work sadly.
I tried this command on windows: dd if=/dev/zero of=\\.\f: bs=512 seek=1 count=1
Output was:
1+0 records in
1+0 records out
Try writing directly to it with HxD. Search your physical drive for "NCSD" and delete 512 (0x200) bytes starting there.

*DISCLAIMER* I just "ported" mid-kid's instructions to HxD, I'm not sure if it'll work, or if it'll completely destroy your filesystem. Make sure to keep a backup.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Veho @ Veho: https://i.imgur.com/bG1pQld.mp4